No settled rule on confidentiality yet; the framework is in draft or newly in force.
What Poland actually says
Poland is the exception that shows how the EU framework behaves when a member state cannot implement it. Three presidential vetoes have blocked the national act, so no authority has been designated to licence providers. Meanwhile the European deadline passed regardless: since July 2026, serving the Polish market without authorisation breaches Union law, and the only lawful route in is cross-border activity by firms licensed elsewhere. Around two thousand registered operators are caught between the two. The substance of the dispute is directly relevant here, because the objections concerned how long a regulator may freeze accounts and block domains without a court, which is the supervisory-power question underneath most privacy arguments.
The instruments that matter
- Three presidential vetoes
- the crypto market bill was vetoed on 1 December 2025, again on 12 February 2026, and a third time in June 2026 after the Sejm passed a revised version on 15 May 2026
- No competent authority designated
- the vetoed bill would have empowered the financial supervision authority to supervise the market, licence operators and impose penalties; without it, the regulator cannot grant authorisations
- The perimeter closed anyway on 1 July 2026
- providing crypto-asset services without authorisation from that date breaches Union law, leaving cross-border service by firms licensed in other member states as the only lawful route
- Roughly 2,000 registered firms in limbo
- with no domestic licensing path, operators have been seeking authorisation in other member states and passporting back
What this means for confidential transactions
Bubble is built for exactly this shape of obligation: amounts and balances live on chain as ciphertexts, computation happens without decryption, and the only disclosure path is an on-chain access list through which an authorized party - an auditor, a supervisor, a counterparty - can request scoped decryption. That is confidentiality from the public, not from the regulator.
Related entries
- UkraineEurope · The law that passed and never commenced
- AustriaEurope · EU baseline, with an early transition close
- BelgiumEurope · EU baseline, with no national layer on confidentiality
- CzechiaEurope · EU baseline, supervised by the central bank
- DenmarkEurope · EU baseline, with tax as the historic pressure point
- EstoniaEurope · The licence cull that reshaped the European market
Compliant by default.
See how selective disclosure satisfies a supervisor without publishing your book to the world.